DRAFT — must be reviewed and finalized by legal counsel before launch.
Security
Last updated: 20 July 2026
Bank-statement data is sensitive, and BankStmt is built accordingly. This page describes the security measures actually in place. It describes practices, not certifications — where we hold no independent certification, we say so rather than imply one.
Encryption
- All traffic is encrypted in transit with TLS.
- Data is encrypted at rest in managed storage and databases.
- Sensitive fields receive additional application-level encryption (AES-256-GCM) with keys held in a managed secret store, never in source code or configuration files.
Tenant isolation
Every record is bound to a tenant, and tenant scoping is enforced in the application and query layers on every read and write — including through the public API, where an API key resolves strictly to its own tenant. Cross-tenant access is not possible through the product surface.
Access control
- Authentication is delegated to a dedicated identity provider using standard OpenID Connect with PKCE.
- Plan entitlements and premium features are enforced server-side, not merely hidden in the interface.
- Internal access to production follows least privilege, is limited to what is needed to operate the Service, and is logged.
- API keys are stored only as hashes; the secret is displayed once at creation and cannot be retrieved afterwards. Keys can be scoped read-only, given an expiry, and revoked instantly.
Data residency
You choose the region where your documents are stored, by country, at upload time. Content stays in the region you select. See the Privacy Policy for how international transfers are handled when operating the Service requires one.
Monitoring, logging and resilience
- Significant actions are recorded in an audit log.
- Rate limiting and abuse protection guard both the application and the public API.
- Databases are backed up regularly, with restores exercised; backups are encrypted.
- Dependencies are patched on an ongoing basis and errors are monitored to catch faults early.
Your data, your control
You can export your data at any time in open formats, delete individual statements, or delete your account entirely — which removes your content, subject only to legally required retention and the backup overwrite cycle described in the Privacy Policy.
Certifications
BankStmt does not currently hold SOC 2, ISO 27001 or PCI DSS certification, and does not claim to. Card payments are handled entirely by our PCI-DSS-compliant payment processor, so card data never reaches our systems. If you require a specific certification or a completed security questionnaire, contact security@bankstmt.com to discuss.
Reporting a vulnerability
Report security issues to security@bankstmt.com. We aim to acknowledge within 2 business days and to keep you updated until resolution. Please follow the responsible-research conditions in the Acceptable Use Policy.
Contact
Questions about these documents or your data? Contact privacy@bankstmt.com. For security matters, contact security@bankstmt.com.